RAP Sheet home
Install the bug reporting skill
67 people reported

All time, since Sep 14, including 10 thumbs-up on GitHub.

Windows opaque blocked-by-policy rejections

“An owner-authorized, guarded read-only verification launcher was rejected before process creation in Codex desktop.”

Is this your bug? What gets counted gets fixed. Pile on.

Paste this into your agent. It files your report, with your error and version.

I hit this bug: rapsheet.dev/sheets/codex/themes/125/file
Follow it to file my report. Show me the text before you send.

No install. No account. Public and anonymous. The link asks your agent for one report, nothing else. What it sends

Fading. 6 reports and thumbs-up in the last 7 days and 10 the week before, down from 14 a week at the mid-October peak.

4 bugs in this theme

  1. Unexplained blocked by policyNo workaround yet58 people
  2. Blocked by policy, no rule shownNo workaround yet3 people
  3. Opaque blocked by policy rejectionNo workaround yet3 people
  4. PowerShell commands rejected when a URL and start appear togetherHas a workaround3 people

What's included

  • exec_command fails with "CreateProcess … rejected: blocked by policy" before PowerShell starts, naming no rule or recovery step
  • Happens with approval_policy never and danger-full-access / Full Access selected, with no approval prompt offered
  • Triggered by authorized process restarts, cache or file cleanup, file writes, previews and diagnostics, in the desktop app and VS Code extension
  • Commands containing a URL plus a "start" token match the Windows URL-launch check
  • Agent misattributes the refusal to auto-review or keeps claiming it cannot retry after the rejection

Not included

  • A browser-tab read denied in a cloud chat where /approve shows no commands
  • Auto-review refusing user approval relayed from a parent or another chat

Original reports58, newest first

  1. Windows: command rejected as “blocked by policy” despite Full access, with no actionable decision traceOn GitHub#59415
  2. Automatic approval review blocks approved read-only local Docker diagnostic without explanationOn GitHub#59216
  3. Windows desktop: local validation rejected before process creation; no /approve denial listOn GitHub#59023
  4. exec_command rejected by policy with Full access enabled and no approval or resume optionOn GitHub#58900
  5. VS Code on Windows: pre-execution blocked by policy with no matching execpolicy rule; feedback permission errorOn GitHub#58601
  6. Windows: Local CreateProcess command blocked by policy without explanationOn GitHub#58550
  7. approval_policy: NeverOn GitHub#58458
  8. Windows desktop: CreateProcess blocked by policy without actionable per-call denial detailsOn GitHub#58437
  9. Windows desktop: selected exec_command operations rejected before process creation with unexplained blocked by policyOn GitHub#58377
  10. [Windows desktop] exec_command rejected before process creation with only "blocked by policy"On GitHub#58234
Show all 58Show only the newest 10
  1. Windows Codex returns “blocked by policy” without an actionable reasonOn GitHub#57623
  2. Windows desktop: source-generation command rejected as “blocked by policy” without explanationOn GitHub#57566
  3. Windows desktop: authorized local video launch rejected before CreateProcess without an actionable policy reasonOn GitHub#56872
  4. Windows: unexplained “blocked by policy” refusal prevents safe editing-service recoveryOn GitHub#56867
  5. Codex on Windows rejects an authorised command with “blocked by policy” but gives no reason or recovery actionOn GitHub#56722
  6. Windows desktop: explicitly authorized directory deletion blocked by policy with Full Access and auto approve (26.1016.62342)On GitHub#56572
  7. Windows: pre-execution policy rejection lacks actionable diagnostics for bounded Gradle test invocationOn GitHub#56513
  8. Windows: opaque policy rejection blocks SHA-256-verified duplicate extraction cleanupOn GitHub#56344
  9. Windows: command rejected by policy under Full Access, no reason or matching approvalOn GitHub#56251
  10. Windows desktop: CreateProcess policy rejection gives no enforcing rule or supported authorization path (bundled CLI 0.163.0-alpha.10.2)On GitHub#55914
  11. Windows desktop: local QA app Start-Process rejected before PowerShell creation without policy provenanceOn GitHub#55721
  12. Windows Full access blocks authorized file cleanup without an approval path; use Auto-review or restore previous behaviorOn GitHub#55197
  13. Windows: URL-launch classifier mistakes -Stage Start argument for a command under neverOn GitHub#55117
  14. Windows: exec_command blocked before CreateProcess while creating three JSON filesOn GitHub#55022
  15. Windows: native application acceptance blocked before execution with no actionable approval pathOn GitHub#54942
  16. Codex Windows: CreateProcess Rejected blocked by policy despite Full AccessOn GitHub#54746
  17. Windows: unexplained "blocked by policy" prevents test-artifact cleanup despite effective Full AccessOn GitHub#54610
  18. Windows: blocked by policy on legitimate PowerShell file creation despite Unrestricted AccessOn GitHub#54543
  19. CreateProcess Rejected: blocked by policy — request per-call investigationOn GitHub#54206
  20. Windows Codex app 26.1007.71326, build 20398. An explicitly authorized Test-only deployment coordination command is rejectedOn GitHub#54126
  21. Windows: authorised local commands rejected with “blocked by policy” and no explanationOn GitHub#53982
  22. Windows IDE extension: exec_command fails with “CreateProcess … rejected: blocked by policy” without an actionable explanationOn GitHub#53981
  23. Windows desktop: pre-launch CreateProcess policy denial with full-access turn context and no actionable reasonOn GitHub#53979
  24. Windows Codex desktop: read-only local diagnostic command rejected with CreateProcess: blocked by policyOn GitHub#53977
  25. Desktop: local recorder preflight evidence command rejected before execution with only “blocked by policy”On GitHub#53948
  26. Windows app: “blocked by policy” with Full Access and unconfirmed feedback submissionOn GitHub#53215
  27. Codex Windows pre-execution policy rejection blocking owner-authorized local gateway recoveryOn GitHub#52914
  28. Windows desktop: local preview replacement rejected before process creation with no actionable policy reasonOn GitHub#52202
  29. Windows: authorized cache cleanup blocked, followed by repeated stale refusals without fresh execution attemptsOn GitHub#52170
  30. [ChatGPT → Codex][Remote MCP] Opaque safety block propagates into repeated refusal without native approval or recoveryOn GitHub#52095
  31. Windows Desktop: authorized local app/gateway update blocked by policy and misreported as auto-review denialOn GitHub#52019
  32. errorOn GitHub#51418
  33. Windows 0.154.0-alpha.6.2: pre-process policy denial lacks rule diagnostic despite unmatched user execpolicy rulesOn GitHub#50979
  34. Windows: authorized cleanup and read-only command-text diagnostic rejected before executionOn GitHub#50896
  35. Windows: exec_command rejected as “blocked by policy” without an actionable explanationOn GitHub#50884
  36. Windows Desktop pre-execution policy rejection has no rationale or verified review routeOn GitHub#50745
  37. Windows desktop blocks authorized service restart without an actionable explanationOn GitHub#50712
  38. Windows desktop: explicitly authorized duplicate-file cleanup rejected with "blocked by policy" and no actionable diagnosticOn GitHub#50565
  39. Unclear reason for rejection with “blocked by policy”; /approve shows no entriesOn GitHub#50524
  40. Windows: exec_command rejected with “blocked by policy” without an actionable explanationOn GitHub#49373
  41. Windows app: opaque policy denial while preparing an owner-approved maintenance scriptOn GitHub#48974
  42. Windows CLI 0.157.0: authorized local recovery blocked by policy without explanationOn GitHub#48202
  43. Windows IDE: local observer launch rejected as “blocked by policy” without an actionable approval recordOn GitHub#48128
  44. Full Access blocks commands without an approval prompt on WindowsOn GitHub#47213
  45. [Windows App 26.908.9136.0] Guarded local API restart blocked before execution; possible cross-command URL-launch matchOn GitHub#46364
  46. Windows: local Markdown QA report write rejected before execution with "blocked by policy", no review entryOn GitHub#45986
  47. Windows PowerShell execpolicy blocks benign CLI start subcommand with --server URLOn GitHub#45793
  48. Windows desktop Full access: forced test-file cleanup denied with opaque blocked by policy and no review pathOn GitHub#45403

Do you work on Codex?

Claim its RAP Sheet to see what your users report and answer them in one place.

Claim a tool